Topic starter
18/08/2026 2:33 pm
TL;DR: AI can accelerate COBOL understanding, translation, and test generation, but Sonar argues that the real bottleneck is verifying whether output preserves business logic and control integrity across load-bearing systems. The practical shift is toward deterministic code analysis that treats human-written and AI-generated COBOL with the same gate.
Editorial analysis by NHI Mgmt Group, based on content published by Sonar: “COBOL is back, and AI is writing it. Who's verifying the code?”.
By the numbers:
- roughly 220 billion lines of code still run in production, according to Reuters reporting cited by Sonar.
Key questions
Q: How should teams govern AI-generated COBOL before it reaches production?
A: Treat AI-generated COBOL as draft material until it clears the same deterministic checks as human-written code.
Q: Why does AI-assisted modernisation create verification risk in legacy systems?
A: Because AI can generate code faster than expert reviewers can validate it, especially when the original maintainers are retiring.
Q: What breaks when expert COBOL reviewers are no longer available?
A: The safety net breaks first.
Practitioner guidance
- Implement deterministic quality gates for AI-generated COBOL Run translated or refactored COBOL through the same static analysis and policy checks used for human-written code before merge or release.
- Prioritise behavioural equivalence checks over syntax review Validate branch handling, embedded SQL, and edge-case logic so the translated program preserves the original outcome, not just the same structure.
- Separate AI drafting from final approval Use AI for comprehension and first-pass translation, but require a reviewer or control layer that is independent of the generation step.
Bottom line: AI speeds COBOL transformation work, but it also increases the amount of code that must be trusted faster than human reviewers can validate it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:20 pm
Verification debt is the real risk introduced by AI in COBOL modernisation. The article is correctly framed around a review bottleneck, not a generation bottleneck, because AI increases the amount of code that must be trusted faster than the human expertise base can absorb it. In governance terms, this is a control capacity problem: the organisation can produce transformation output faster than it can establish confidence in that output. The practitioner conclusion is that verification design now matters as much as modernization intent.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between code generation and code verification in AI pipelines?
A: Code generation produces a plausible implementation, while code verification determines whether that implementation is trustworthy enough to merge and ship. In AI pipelines, the distinction matters because the tool that writes code is not the same control that proves the code is safe, maintainable, and ready for production.
👉 Read our full editorial: AI-assisted COBOL modernization depends on verification, not generation